Calling principal does not have required MSGraph permissions

Question

I have a Runbook (Automation Accounts) parsing AAD SignIn and Audit logs, however, when it executes Get-AzureADAuditSignInLogs I'm getting the following error:

`Get-AzureADAuditSignInLogs : Error occurred while executing GetAuditSignInLogs Code:     Authentication_MSGraphPermissionMissing Message: Calling principal does not have required MSGraph     permissions AuditLog.Read.All`

The Managed Identity I'm using in Runbook has Security Reader role, but it doesn't seem to be enough?

Answer 1

I got the same error when I checked in powershell:

Note: The AuditLog.Read.All permission is an application permission which is part of Microsoft Graph API and not a built-in role in Azure Active Directory (AAD).So it must be granted through an app in azure ad

Create an app in azure ad tenant .For that app create client secret and certificate and note down secret value and certificate thumbprint for both

Give the AuditLog.Read.All Api permissions to it and grant admin consent .

And then go to the azure automation account. Access control IAM blade > add role assignment > security reader or Contributor role to the application

Here I gave Owner role .

In automation account Add a credential button. Enter name and the service principal credentials which are "Application (client) ID" and the "Client Secret".

Then the script to run audit logs can be run successfully

$credential = Get-AutomationPSCredential -Name "myrunbookcred"
Connect-AzureAD -TenantId "xxxxxxx" -ApplicationId "axxxxxxxx26 " -CertificateThumbprint "1C6BFB53xxxxxxxxxxx3CD401" -Credential $credential

Get-AzureADAuditSignInLogs